30-09-2026
TOPHIT. Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2
https://cdn.cloudsek.com/cloudsek-blog-pdfs/tophit-part-8ysx.pdf
Report completeness: Medium
Threats:
Typosquatting_technique
Supply_chain_technique
Victims:
Javascript ecosystem, Vast.ai marketplace
Industry:
E-commerce
Geo:
Singapore, Pakistan, United states
TTPs:
Tactics: 2
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1016, T1033, T1036.005, T1041, T1046, T1059, T1059.007, T1071.001, T1082, T1195.002, have more...
IOCs:
IP: 2
Email: 2
File: 20
Hash: 85
Soft:
Node.js, Linux, OpenSSH, Ubuntu, uvicorn, FastAPI, Jupyter, Jupyter notebook, Caddy, Docker, have more...
Algorithms:
ecdsa, exhibit, sha256
Functions:
require, fp, setInterval
Win API:
lockfile
Languages:
javascript, python